Zapscape KVM Flaw Lets L1 Guests Escape to Linux Hosts (CVE-2026-64561)

A newly disclosed Linux kernel vulnerability dubbed Zapscape (CVE-2026-64561) could allow an attacker with kernel-level access inside an L1 guest virtual machine to break out of KVM isolation and execute arbitrary code on the host. Security researcher Hyunwoo Kim, who reported the flaw, demonstrated that a malicious guest root user could leverage the bug to run commands on the host with full kernel privileges, dropping a root-owned file (/Zapscape) as proof. The vulnerability resides in KVM/x86's shadow memory management unit (MMU), which governs nested page tables for guest memory translation, and primarily threatens environments that expose nested virtualization to untrusted tenants.

Technically, Zapscape is a stale-root check ordering bug in KVM's shadow-MMU bookkeeping that leads to a use-after-free during guest-triggered page fault handling. When KVM reclaims MMU pages and invalidates the shadow MMU root, the fault-handling path fails to re-validate that root and continues to allocate child shadow pages under it. Those children inherit an invalid state but remain on KVM's active MMU page list, causing a duplicate list link, a dangling reference, and ultimately a post-free write primitive. On Intel hosts, exploitation requires both EPT page-walk lengths 4 and 5 to be exposed to the L1 guest; AMD SVM/NPT systems have no such precondition, which is why Kim's public proof-of-concept targets AMD nested virtualization on Linux 7.1.3. Kim recommends running the PoC under QEMU's software TCG emulator for safe analysis, noting that QEMU is not itself vulnerable and that the bug lives entirely in in-kernel KVM code.

The upstream fix has already been merged into the Linux kernel, and affected stable branches include 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5, with the NVD listing Linux 5.9 and later as vulnerable prior to patching. Red Hat has assigned a preliminary CVSS score, and administrators running KVM hosts with nested virtualization enabled for untrusted tenants should prioritize updating to a fixed kernel or a vendor package that backports the patch. While Kim's August 6 write-up includes a working PoC, he stresses it is not a turnkey weapon for cloud environments; real-world exploitation would require porting the L1 logic into a guest kernel module and tailoring it to the target host's memory backend and kernel configuration. Operators should audit their KVM deployments, verify host kernel versions, and inspect exposed services with a port scanner to confirm that nested virtualization is not inadvertently enabled on tenant-facing infrastructure. For broader posture checks, a privacy checkup can help surface misconfigurations, and teams investigating vendor advisories can use a WHOIS lookup to verify upstream sources.